firehol-mark(5)

💖 firehol-mark 💖

okay bestie, listen up — this is the firehol-mark(5) page from the FireHOL manual, version 3.1.8, and it's literally the glow-up guide for putting marks on packets. marks are the little sticky notes your kernel puts on traffic so other stuff can find it later. let's get into it 🎀

---

✨ NAME ✨

firehol-mark — set a stateful mark from the usermark group. yes that's the whole vibe. slay.

---

🦋 SYNOPSIS 🦋

{ mark | mark46 } value chain rule-params

mark4 value chain rule-params

mark6 value chain rule-params

like, pick your fighter: mark, mark46, mark4, or mark6, then hand it a value, a chain, and some rule-params. periodt. 💅

---

🌸 DESCRIPTION 🌸

okay so here's the tea: marks on packets can be matched by traffic shaping, routing, and firewall rules for controlling traffic. they're the main character of the packet world, honestly.

Note — behaviour changed significantly in FireHOL v3 compared to earlier versions. like, not a little. a lot. be aware.

also! there's a mark parameter which allows matching marks within individual rules (peep firehol-params(5) for that one, bestie). 👀

FireHOL uses iptables masks to break the single 32-bit integer mark value into smaller groups, and lets you set and match them independently. the markdef group definitions that set this whole thing up live in firehol-defaults.conf. so that's where the magic happens, no cap.

the mark helper command sets values within the usermark group. you can set value between 0 (no mark) and size-1. the default size for usermark is 128, so 127 is the highest value possible. remember that. quiz later. 📝

the default usermark types are stateful+permanent, which means the initial match will only be done on NEW packets, and the mark will be restored to all packets in the connection. it's giving commitment issues but in the best way. 🫶

the chain will be used to find traffic to mark. it can be any of the iptables(8) built in chains belonging to the mangle table. the chain names are:

• INPUT
• FORWARD
• OUTPUT
• PREROUTING
• POSTROUTING

the names are case-sensitive. so input is NOT it. lowercase is not the moment. 💀

the rule-params define a set of rule parameters to match the traffic that is to be marked within the chosen chain. see firehol-params(5) for more details, bestie, it's all there.

big note incoming any mark commands must be declared before the first router or interface. no exceptions. don't test it. also also also: if you want to do policy based routing based on iptables(8) marks, you will need to disable the Root Path Filtering on the interfaces involved (rp_filter in sysctl). that's a real one, don't skip it. and one more for the girlies: FireQOS will read the FireHOL mark definitions and set up suitable offsets and marks for the various groups. if you're using a different tool, you should look at the emitted firewall to determine the final masks and values to use. iykyk. 🔥

---

⭐ EXAMPLES ⭐

# mark with 1, packets sent by the local machine
mark 1 OUTPUT

# mark with 2, packets routed by the local machine
mark 2 FORWARD

# mark with 3, packets routed by the local machine, sent from
#              192.0.2.2 destined for port TCP/25 of 198.51.100.1
mark 3 FORWARD proto tcp dport 25 dst 198.51.100.1 src 192.0.2.2

look at that. clean. iconic. ate. 👑

---

🌈 SEE ALSO 🌈

• firehol(1) — FireHOL program
• firehol.conf(5) — FireHOL configuration
• firehol-params(5) — optional rule parameters
• firehol-connmark(5) — set a stateful mark from the connmark group
• iptables(8) — administration tool for IPv4 firewalls
• ip6tables(8) — administration tool for IPv6 firewalls
• ip(8) — show / manipulate routing, devices, policy routing and tunnels
• FireHOL Website
• Working With Marks Wiki Page
• FireHOL Online PDF Manual
• FireHOL Online Documentation
• Linux Advanced Routing & Traffic Control HOWTO

---

🎀 AUTHORS 🎀

FireHOL Team. 💜

---

and that's the whole page bestie!! this one was FireHOL Reference, built 13 Apr 2025, and it's the firehol-mark(5) page, so if you ever forget it just remember: marks, usermark, mangle, before the first router or interface. mwah 💋✨🌸